CVE-2025-58369: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

The vulnerability is a denial-of-service caused by a spin loop in fs2-io when a client half-closes a connection during a TLS handshake. The provided patches (46e2dc3abf994dcf3d0b804b2ddb3c10c04d4976 and 5c6c4c6c1ef330f7e6b53661ecc63d5f5ba8885c) point to a fix in the io/jvm/src/main/scala/fs2/io/net/SelectingSocketGroup.scala file, specifically within the server method of the SelectingSocketGroup class.

The analysis of the patch shows that the change is in the resource cleanup phase of the ServerSocketChannel. The original code simply closed the channel. The patched code introduces a waitForDeregistration mechanism that ensures the channel is no longer registered with the selector before the cleanup is considered complete. This directly addresses the root cause of the spin loop, which is the selector repeatedly and incorrectly reporting a closed channel as ready for an operation.

Therefore, the vulnerable function is identified as fs2.io.net.SelectingSocketGroup.server. Although the symptom (the spin loop) would be observed in a thread performing a read operation, the actual flaw is in the setup and teardown logic of the server socket managed by this function. An attacker could exploit this by creating many connections to a server using fs2-io with TLS and then half-closing them, causing the server to consume excessive CPU resources and become unresponsive.